What Colorado's AI Hiring Law Requires From Denver Employers and Job Applicants in 2026
Colorado's SB 205 took effect February 1, 2026, making Colorado the first state in the country to enact an AI consumer protection law of this scope. Its formal title is "Concerning Protections for …
Colorado’s SB 205 took effect February 1, 2026, making Colorado the first state in the country to enact an AI consumer protection law of this scope. Its formal title is “Concerning Protections for Consumers Interacting with Artificial Intelligence Systems.” Most Denver employers using AI-assisted hiring tools are not ready for its employment provisions. That’s not a guess — it’s what every employment attorney in this market is saying right now.
You apply for a patient services coordinator role at a major Denver health system. Three days later, an automated email tells you the position has been filled. Your résumé was never read by a human. It was scored, ranked, and rejected by an AI model embedded in the employer’s applicant tracking system before a recruiter ever opened the queue.
Under Colorado SB 205, that employer may have just violated state law.
That gap — between what Denver employers are actually doing and what they’re now legally required to do — is the story.
The Law Is Live
SB 205 is not a future obligation. Not pending rulemaking. Not a pilot program. It took effect February 1, 2026, and the Colorado Attorney General holds enforcement authority with a reported cure window before civil penalties attach.
There’s no federal analog. What Colorado has done is structurally distinct: it treats AI-influenced employment decisions as a category of consequential action that triggers its own disclosure and oversight obligations, separate from existing discrimination law.
That novelty is exactly why most Denver employers are operating in a compliance gray zone. Law firm alerts on SB 205 exist — they’re written for lawyers. Whether the Colorado AG has published plain-language employer guidance or a formal FAQ as of publication should be verified directly at coag.gov. And honestly, the presence or absence of that guidance is itself significant news. A law this consequential, with no accessible plain-language guidance, is a real problem for the small employer trying to comply in good faith.
Mile High SHRM, the Denver metro chapter of the Society for Human Resource Management, is the right local resource for HR professionals seeking peer guidance. The chapter meets monthly and maintains an active email list for members navigating Colorado employment law. If you’re an HR professional and you’re not on that list, fix that.
What the Law Actually Requires
The operative concept in SB 205 is the “high-risk AI system.” In the employment context, that’s any system that makes or significantly influences a consequential employment decision. The definition is broader than it sounds — deliberately so.
It covers initial screening, applicant ranking, scoring, and rejection. If your platform does anything beyond filtering by explicit criteria you set, it almost certainly qualifies.
When a covered AI system is involved in an employment decision, SB 205 requires employers to disclose four things to the affected applicant.
Disclosure that AI was involved. This cannot be buried in a terms-of-service link.
A description of what the AI actually did — whether it scored résumés, ranked candidates by predicted fit, evaluated video interview responses, or used game-based assessments to infer cognitive traits.
A clear mechanism for the applicant to request human review. The employer must have a functioning process to receive and respond to those requests. Not a dead-end email inbox. A functioning process. The distinction matters.
A plain-language explanation of what the AI did. This requires translating vendor outputs into something a job applicant can actually understand — not a technical summary from the vendor’s documentation.
On timing: the exact point at which disclosure is required needs verification against the enrolled bill text. Whether it’s before the AI system is used, contemporaneously, or upon an adverse outcome matters enormously for how employers structure their workflows. Pull the enrolled bill directly from the Colorado General Assembly’s website rather than relying on secondary sources.
Developer vs. Deployer: The Distinction That Changes Everything
Most employer-facing coverage of SB 205 glosses over the statute’s core structural distinction. This is where I see the most confusion in early compliance conversations, and it determines what a Denver employer actually has to do.
SB 205 separates the companies that build AI tools from the companies that use them. A Denver employer using Workday, Greenhouse, iCIMS, HireVue, or any other commercial ATS with AI features is a deployer. The vendor is the developer. Different legal positions, different obligations.
As a deployer, a Denver employer must conduct annual impact assessments of any high-risk AI system in use — actual analysis of demographic performance data to identify whether the AI produces discriminatory outcomes across protected classes, plus documented mitigation measures. Deployers must also verify that vendors can document how the AI model was designed, what data it was trained on, and what demographic testing has been done.
The point that keeps getting missed: you cannot outsource your SB 205 obligations to your vendor. The vendor has its own developer obligations. Yours are separate. Denver HR leaders who haven’t reviewed their ATS contracts with this question in mind are already behind. This is exactly the kind of compliance question covered in our business and professional coverage.
The question to put to your vendor, in writing: does your platform’s AI functionality qualify as a high-risk AI system under Colorado SB 205, and can you provide the technical documentation of design, training data, and bias testing that we need for our deployer compliance? Don’t accept a marketing brochure as an answer.
Which Platforms Are Covered
Denver employers aren’t all using the same tools, and coverage isn’t uniform.
HireVue with AI video scoring clearly qualifies as high-risk AI. The platform uses machine learning to score candidate interview responses before a human recruiter sees them. That’s the core fact pattern SB 205 was designed to address.
Pymetrics and Harver’s game-based assessments work similarly — they infer cognitive and behavioral traits from gameplay data and produce ranked scores used in screening. Same analysis applies.
Eightfold AI falls squarely within the statute’s high-risk definition with its AI-driven candidate ranking and matching.
Workday Recruiting gets more complicated when AI-assisted ranking or Skills Cloud features are enabled. Whether the AI functionality is active and what role it plays in decisions determines coverage — and default settings vary by configuration.
iCIMS with match scoring or Talent AI features presents the same question. The AI ranking functions are opt-in but widely used in enterprise deployments.
Greenhouse in basic ATS mode — posting jobs, collecting applications, organizing pipelines by human-defined stages — operates differently than Greenhouse with AI candidate scoring or fit-prediction features turned on. Know which version you’re running.
LinkedIn Recruiter AI and Indeed Smart Sourcing sit in genuinely disputed territory. The AI ranking in these platforms largely happens at the platform level before an employer sees candidates. Whether a Denver employer using these tools qualifies as a deployer under SB 205 is unresolved. I don’t think anyone has a confident answer yet, and that ambiguity is itself a risk for employers who assume they’re in the clear.
The statute’s critical distinction is between platforms that rank and score candidates versus platforms that filter by employer-specified criteria. If the platform is making a judgment about which candidates are better — not just which ones meet explicit criteria you defined — that’s the triggering function.
Verify the current configuration of your specific instance. Vendors update their products constantly.
The Small Business Question
Denver’s small-business community has a direct stake in how SB 205 applies. The answer is not “you’re exempt.”
SB 205 includes a carve-out for small deployers that limits certain audit and impact-assessment obligations. The specific employee-count threshold requires verification against the enrolled bill text.
What the carve-out does not do: exempt small employers from disclosure requirements. A Denver restaurant group using Indeed Smart Sourcing with AI ranking enabled still likely owes applicants all four disclosure elements. A small marketing agency using Workable with AI-assisted candidate scoring does too.
Most small employers using these tools have no idea the AI features are active. Many off-the-shelf recruiting platforms enable AI ranking by default — it’s not something you consciously turn on, it’s a setting you have to actively turn off. If you haven’t checked your platform settings recently, check them now.
For small Denver employers without in-house HR counsel, the Denver Small Business Development Center at Auraria Campus is a practical starting point. The SBDC doesn’t provide legal advice, but it can help identify the right questions and connect employers with affordable legal resources. Denver small employers navigating Colorado’s evolving employment mandates may also find useful context in how Denver small employers are managing Colorado FAMLI costs at the one-year mark, another state requirement that landed with limited plain-language guidance.
Can Your Employer Legally Use AI to Screen Your Application in Colorado?
Yes. SB 205 does not ban AI from employment decisions. It regulates the conditions under which AI can be used and guarantees applicants specific rights when it is.
If you’re a Denver job seeker wondering whether the company you applied to can run your résumé through an AI scoring system, they can. What they cannot do is use that AI without telling you, without giving you a mechanism to request human review, and without being able to explain in plain language what the AI actually did.
Those are meaningful rights. Whether employers are honoring them yet is a different question.
If an AI Rejects Your Application, Here’s What You Can Actually Do
Under SB 205, you have a right to request human review of any AI-influenced adverse employment decision.
Make the request in writing. Contact the employer’s HR department or the recruiting contact listed in the job posting. State that you are requesting human review under Colorado SB 205, identify the position you applied for, and ask them to confirm whether an AI system was used in evaluating your application.
The employer is required to have a process for receiving and responding to those requests, and to provide the four disclosure elements. If they can’t tell you whether AI was used, that potentially violates the law itself.
Here’s the honest limitation: enforcement authority under SB 205 rests with the Colorado Attorney General’s office, not individual applicants. There is no confirmed private right of action. You cannot sue the employer directly under SB 205 for a disclosure violation. Your path is filing a complaint with the AG’s Consumer Protection Section — which means your leverage as an individual applicant is indirect.
But complaints create a record. A pattern of complaints against a specific employer is exactly what prompts AG action.
When filing a complaint, include: the employer’s name and address, the position and approximate application date, the name of the ATS or AI tool if you can identify it, whether you received any disclosure that AI was used, and whether your request for human review was acknowledged or ignored. File at coag.gov. Check current complaint procedures there directly — form locations change.
Penalties, the Cure Period, and What Enforcement Looks Like
Civil fines are reported at up to $20,000 per violation. Verify the specific amount and whether it applies per incident, per affected applicant, or per affected class against the enrolled bill. That per-incident calculation has material consequences for high-volume hirers — a health system processing thousands of applications per month is doing very different math than a small employer running two searches a year. Willful violations carry higher exposure. No criminal penalties under the employment provisions.
The most important thing Denver employers need to understand about enforcement: the cure period. If the AG notifies an employer of a violation, the employer reportedly has 60 days to come into compliance before civil penalties attach. An employer that hasn’t built disclosure processes but acts immediately on a notice can avoid fines. One that ignores the notice cannot.
This structure means the AG’s enforcement posture will likely begin with notices rather than penalties. “Likely begins with notices” is not the same as “no consequences.” A notice of violation is a public document. And if your compliance gaps are structural rather than procedural, 60 days may not be as comfortable as it sounds.
Documenting your good-faith compliance efforts now, before any complaint is filed, is the closest thing to a safe harbor currently available. It’s not a guarantee — it’s just what you have.
The Sectors With the Most Exposure in Denver
Healthcare systems carry significant exposure. UCHealth, Denver Health, and HealthONE run some of the highest-volume hiring operations in the metro. Enterprise ATS platforms at health systems come with AI features that may be enabled by default. A hospital HR team posting dozens of positions simultaneously and processing thousands of applications per month has serious disclosure infrastructure to build, with little margin for a process that fails at scale. Denver Health, as a public entity, carries an additional open question: whether SB 205’s deployer obligations apply to public-sector employers requires verification against the enrolled bill’s definitions. Same question applies to Denver International Airport and the City and County of Denver, which are among the metro’s largest employers by headcount.
Denver’s tech sector uses sophisticated screening tools. Palantir on Platte Street, Ibotta, Guild Education, and dozens of growth-stage companies in RiNo have likely engaged employment counsel on AI-related questions already. But having an AI governance policy and having SB 205-compliant disclosure workflows are different things. Disclosure compliance is operational — HR teams have to actually implement it — and that’s where the gap between “we have a policy” and “we’re actually compliant” tends to appear.
Hospitality carries underreported exposure. Sage Hospitality — whose Denver portfolio includes The Crawford Hotel at Union Station — and hotel franchisees running Marriott and Hilton parent-company platforms process high volumes of hourly-worker applications for front desk, housekeeping, and food and beverage roles, often through platforms with AI ranking enabled. The applicant population is largely non-union and the least likely to know their rights under SB 205.
This is the part of the law worth paying close attention to. The protection is uniform across job type and wage level. A housekeeper applicant at a downtown Denver hotel has the same disclosure rights as a software engineer applicant at a LoDo tech company. Whether employers are treating those applicants equally in practice is another matter entirely.
Graduates from Auraria Campus — home to Metropolitan State University, CU Denver, and Community College of Denver — are entering the Denver job market in substantial numbers and are disproportionately likely to encounter AI screening at their first employers. They’re also the applicant group least likely to know SB 205 exists.
What Denver Employers Should Do Before the Next Hiring Cycle
Audit your ATS contract and platform configuration first. Pull your vendor agreement. Identify every AI-enabled feature in your current ATS instance — ranking, scoring, fit prediction, skills matching — and confirm whether each is active. Ask your vendor in writing whether those features qualify as high-risk AI systems under SB 205, and request the technical documentation you need for your deployer obligations. If they can’t produce it, document that and escalate. “We asked and they didn’t answer” is a data point. Keep the email trail.
Draft or update your application-stage disclosure language. Your job postings and application portals need language that meets all four disclosure elements — readable by a job applicant, not a lawyer. If they currently say nothing about AI use, rewrite them before your next hire.
Build a human-review request process. Name an internal contact who receives and responds to review requests. Define a response timeline. Write it down. If a rejected applicant submits a request for human review and it lands in an unmonitored inbox — or there’s no process at all — that’s a problem the AG’s office can document in about ten minutes.
Calendar the annual impact assessment and assign ownership. Someone needs to own it — HR, legal, or outside counsel — and it needs to be on the calendar before the end of 2026. “We’ll get to it” is not a compliance posture.
For peer guidance, Mile High SHRM is the right first call for Denver HR professionals. For legal review before your next high-volume hiring window, Denver’s employer-side employment practices groups have the Colorado employment law depth appropriate for a compliance review: Ogletree Deakins at 1700 Lincoln St, Fisher & Phillips at 1125 17th St, and Holland & Hart.
One final note for job applicants: the next time you apply at a Denver company, look for a disclosure. If you don’t see one and you have reason to believe AI screening was used, document it. The absence of a required disclosure is exactly what a complaint to the AG’s office is built on.
SB 205 sits at the intersection of technology, employment, and civil rights. It’s also, right now, a law that most of the Denver employers it covers haven’t put into operation. The employers who act before the first complaint is filed are in a materially better position than those who wait — and in my experience covering this city’s business community, the ones who wait always think they have more time than they do.
